On 2 August 2026, five months from now, the EU AI Act’s high-risk AI rules come into full force. The obligations apply to providers and deployers of high-risk AI systems operating in or selling into the EU market. The penalties for non-compliance reach up to €35 million, roughly £30 million, or 7% of worldwide turnover, whichever is higher.
Most of the conversation so far has been in tech and legal circles. That needs to change. Because the built environment has a compliance problem it hasn’t fully clocked yet.
What Makes an AI System “High-Risk” in Construction?
The Act uses a risk-based classification system. An AI system becomes high-risk under two routes. First: if it is embedded as a safety component in a product regulated under EU product safety law, such as the Machinery Regulation, and that product requires a third-party conformity assessment. Second: if it falls into one of the specific use-case categories listed in Annex III.
Both routes have teeth in construction. A computer vision system that monitors whether a tower crane’s load limits are being respected could qualify as a safety component under the Machinery Regulation. A software tool that allocates site shifts, evaluates worker performance, or monitors individual behaviour on site sits squarely in Annex III, Category 4: Employment and Workers Management.
Think about the tools already in use. AI-driven scheduling and resource allocation platforms. Predictive safety monitoring with wearables. Computer vision for PPE compliance. Automated subcontractor performance scoring. Several of these are likely to meet the high-risk threshold.
What Providers and Deployers Actually Have to Do
The Act distinguishes clearly between providers (firms that develop or put an AI system on the market) and deployers (firms that use it in their operations). Both have obligations. Providers carry the heavier load: they must implement a continuous risk management system, maintain detailed technical documentation, enable human oversight, and complete a conformity assessment before placing the product on the EU market. Then affix the CE marking and register in the EU database.
Deployers, which is most construction firms buying in AI tools, must use systems in accordance with the provider’s instructions, assign trained human oversight, monitor performance, retain logs, and report serious incidents. If the deployer controls the input data, responsibility for its quality sits with them.
Here is the practical question your QS or FM team should be asking right now: for every AI tool you are using on EU projects or with EU clients, have you seen a conformity assessment? Does the provider’s documentation actually exist? Have you assigned anyone to be responsible for monitoring it in operation?
UK Firms Are Not Off the Hook
Brexit did not create an exemption. The EU AI Act applies to any provider or deployer whose AI system is used in the EU or whose outputs affect people in the EU. For UK construction firms operating across Europe or with EU clients, the obligations are real. If you are selling an AI-enabled construction product into the EU market, you need to comply. If you are deploying an AI workforce management tool on an EU project site, you need to comply.
There is one important timing caveat. The European Commission’s Digital Omnibus proposal, published in November 2025, would push Annex III high-risk deadlines back, potentially to December 2027, because harmonised technical standards are not ready in time. But that proposal is still being negotiated in Parliament. Until it passes, the 2 August 2026 deadline stands.
The smart move is not to wait. Firms that get ahead of the conformity assessment process now, mapping which AI tools they use, reviewing provider documentation, assigning governance accountability, will be better placed regardless of whether the deadline holds or slips. Understanding AI regulation is fast becoming a core competence for built environment professionals. The Responsible with AI programme is designed specifically to help construction, FM, and QS firms build that competence — so that when the regulator or the client asks, the answer is ready.
